HackBlue

Tools · Incident response playbooks · 26 / 27

A bridge link is not an attendance list

The link is where a call could happen. Names and decisions are separate notes. Do not infer who joined.

10 min read · practice only with authorization

Attendance is its own list

People who joined belong on a list someone wrote: names, or a roster export, with a time. If that list is missing, write that attendance was not recorded. Do not copy the on-call roster into the gap.

A decision is a sentence in the notes. Silence after a link is not agreement.

What the ticket can claim

File the link, when it was posted, the attendee list if you have it, and any decision text. Keep those as separate lines. A later reader should not have to guess that a URL meant a unanimous call.

Lab: a link with no names

At 14:10 UTC the ticket gains https://meet.lab.example/ir-2026-014. No attendee list is written, and no decision sentence follows. A draft says the on-call roster joined and agreed to isolate lab-web-02.

The note says the link was posted at 14:10. Attendance: not recorded. Decisions: none in the ticket. Isolation is not claimed from the link.

Snippet
incident: IR-2026-014
link posted: 2026-11-02T14:10:00Z
url: https://meet.lab.example/ir-2026-014
attendees: not recorded
decisions: none in the ticket
not: the roster agreed to isolate

Diagram

What a bridge link does not fill in

The URL is the place. People and decisions are other lines.

  • Link

    The URL that was posted, and when it was posted.

  • Attendees

    Only names that were written down. Otherwise not recorded.

  • A decision

    Only a sentence in the notes. A link is not a vote.

  • The on-call roster

    Not a substitute list. Do not paste it in as attendance.

Check yourself

1. A ticket contains a meet URL posted at 14:10 and no names. What is the URL?

2. Where do attendee names have to come from?

3. No decision sentence follows the link. What was decided?